At a glance
- Google Analytics, which sets cookies, runs only if you allow it. Without your consent the site sets no cookies and tracks nothing.
- The only personal data I ask for is your email, if you sign up for my newsletter.
- A few trusted services help run the site, and they see technical data like your IP address. They are listed below.
- You can ask me to see, correct or delete your data at any time.
Who is responsible
This site is run by me, Yunis Mikayilov, a designer based in Warsaw, Poland. I am the controller of the personal data described here. For anything about your data, email me at yunis@foxxy.io.
When you visit the site
Like every website, this one has to be delivered to your browser. When you load a page, the hosting provider, Vercel, briefly processes technical data: your IP address, the page you asked for, the time, and your browser and device type. Images come from Sanity's content delivery network, which processes the same kind of data. This is needed to show you the site and to keep it secure and working, which is my legitimate interest (GDPR Art. 6(1)(f)). I do not use this data to identify you, and these server logs are kept only for a short time under each provider's own rules.
Fonts are served from this site itself, so loading a page sends no request to Google or other font services.
Cookies and browser storage
The only cookies on this site are Google Analytics' own, and only if you allow them (see below). There is no advertising or other tracking.
The site does keep a few small notes in your browser's own storage, only so the interface behaves well: whether you switched Dev Mode on, which one-time tips you have already seen, whether you are on the newsletter, and your cookie choice. They never leave your device, I cannot read them, and clearing your browser data removes them.
Analytics, only with your consent
On your first visit the site asks whether I may use Google Analytics. If you click "No thanks", or do nothing, it never loads. If you click "Allow", it helps me see which pages people read, how they found the site, and which links they follow, so I can make the site better. This rests on your consent (GDPR Art. 6(1)(a)), and for the cookies themselves on the Polish electronic communications law that implements the EU ePrivacy rules.
Google Analytics, provided by Google Ireland Limited, then sets its cookies (_ga and _ga_ followed by an ID), which last up to two years, and records pages viewed, rough location, device and browser type and how you reached the site. Google says Google Analytics 4 does not store IP addresses. The analytics data is kept for up to 14 months. I cannot identify you from it, and I do not combine it with anything else.
You can change your mind any time with "Cookie settings" at the bottom of every page. Withdrawing turns analytics off and removes its cookies.
The newsletter
If you sign up for Notes from Yunis, I collect your email address to send you the newsletter, based on your consent (GDPR Art. 6(1)(a)). You confirm the signup from a link in your inbox, so nobody can subscribe you by mistake.
The newsletter is sent with Kit (formerly ConvertKit), which stores your email and records whether the emails are delivered, opened and clicked, so I can tell what is useful and keep the list healthy. Every email has an unsubscribe link, and you can withdraw consent at any time. I keep your email while you are subscribed and remove it when you unsubscribe or ask me to.
Videos on case pages
Some case studies show videos hosted on Vimeo. When a video plays, your browser loads it from Vimeo's servers, so Vimeo receives your IP address and technical data. I load the videos in Vimeo's "do not track" mode, so they are not used to track you. This rests on my legitimate interest in showing my work properly (GDPR Art. 6(1)(f)).
When you email me or book a call
If you email me, I receive your email address, name and whatever you write, and I use them to reply. My email is hosted by Zoho Mail in the EU. I keep messages as long as we are in touch about the topic, and delete them on request. Depending on the message, this rests on taking steps towards working together (GDPR Art. 6(1)(b)) or my legitimate interest in answering you (Art. 6(1)(f)).
Booking a call takes you to Cal.com, and links such as LinkedIn, X, Medium and Contra take you to other sites. Those services handle your data under their own privacy policies.
Services I use
- Vercel: hosting and delivery of the site.
- Google Analytics: visitor statistics, only with your consent.
- Sanity: stores the site's content and serves its images.
- Kit: sends the newsletter and stores subscribers.
- Vimeo: hosts the videos on case pages.
- Zoho Mail (EU): my email.
Some of these companies are based in the United States. Where your data leaves the European Economic Area, they protect it with the safeguards the GDPR requires, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. I do not sell your data or share it with anyone else.
Your rights
Under the GDPR you can ask me to:
- show you the personal data I hold about you, and give you a copy;
- correct it if it is wrong;
- delete it;
- limit how I use it, or object to how I use it;
- send it to you or another provider in a common format.
Where I rely on your consent, like the newsletter or analytics, you can withdraw it at any time. Email me at yunis@foxxy.io and I will reply within a month. You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, or to the authority in the EU country where you live.
I make no automated decisions about you, and I do not build profiles.
Changes
If the site starts handling data differently, I will update this page and the date at the top. See also the terms of use.